| tiêu đề | Sangfor Operation and Maintenance Management System (OSM / 运维安全管理系统) 3.0.8 OS Command Injection |
|---|
| Mô tả | A critical Remote Command Execution (RCE) vulnerability exists in the Sangfor Operation and Maintenance Management System (OSM) version 3.0.8. The vulnerability is located in the /isomp-protocol/protocol/getCmd endpoint. The application fails to properly sanitize the sessionPath parameter in an HTTP POST request.
Specifically, the WriterHandle.getCmd() method retrieves the user-supplied sessionPath and passes it to WriterHandle.getCmd(), which directly concatenates the parameter into a shell command string without sufficient validation or escaping. This string is then executed by ShellExecutor.service().exe(). An unauthenticated remote attacker can exploit this vulnerability by injecting shell metacharacters (e.g., ;) into the sessionPath parameter to execute arbitrary system commands with the privileges of the web server (typically root or tomcat). |
|---|
| Nguồn | ⚠️ https://github.com/master-abc/cve/issues/12 |
|---|
| Người dùng | nestor233 (UID 94006) |
|---|
| Đệ trình | 30/12/2025 17:40 (cách đây 6 các tháng) |
|---|
| Kiểm duyệt | 09/01/2026 18:12 (10 days later) |
|---|
| Trạng thái | được chấp nhận |
|---|
| Mục VulDB | 340346 [Sangfor Operation and Maintenance Management System đến 3.0.8 getCmd WriterHandle.getCmd sessionPath nâng cao đặc quyền] |
|---|
| điểm | 20 |
|---|